From c93be5e2af4e1ec0b8de920bddc326f37b19f849 Mon Sep 17 00:00:00 2001 From: Kangseok Thomas Lee Date: Mon, 3 Dec 2018 16:02:06 +0900 Subject: [PATCH] securityContext in prometheus-operator needs to be configurable (#9595) the current securityContext is fixed. it needs to be configurable Signed-off-by: gangseok.lee --- stable/prometheus-operator/Chart.yaml | 2 +- stable/prometheus-operator/README.md | 1 + .../templates/prometheus-operator/deployment.yaml | 5 +++-- stable/prometheus-operator/values.yaml | 4 ++++ 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/stable/prometheus-operator/Chart.yaml b/stable/prometheus-operator/Chart.yaml index 9c8970df33..171c4b0c2d 100644 --- a/stable/prometheus-operator/Chart.yaml +++ b/stable/prometheus-operator/Chart.yaml @@ -9,7 +9,7 @@ name: prometheus-operator sources: - https://github.com/coreos/prometheus-operator - https://coreos.com/operators/prometheus -version: 0.1.28 +version: 0.1.29 appVersion: "0.25.0" home: https://github.com/coreos/prometheus-operator keywords: diff --git a/stable/prometheus-operator/README.md b/stable/prometheus-operator/README.md index a59318fe2a..14f5c15006 100644 --- a/stable/prometheus-operator/README.md +++ b/stable/prometheus-operator/README.md @@ -81,6 +81,7 @@ The following tables lists the configurable parameters of the prometheus-operato | `prometheusOperator.service.nodePort` | Port to expose prometheus operator service on each node | `38080` | | `prometheusOperator.service.annotations` | Annotations to be added to the prometheus operator service | `{}` | | `prometheusOperator.resources` | Resource limits for prometheus operator | `{}` | +| `prometheusOperator.securityContext` | SecurityContext for prometheus operator | `{"runAsNonRoot": true, "runAsUser": 65534}` | | `prometheusOperator.nodeSelector` | Prometheus operator node selector https://kubernetes.io/docs/user-guide/node-selection/ | `{}` | | `prometheusOperator.tolerations` | Tolerations for use with node taints https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ | `[]` | | `prometheusOperator.affinity` | Assign the prometheus operator to run on specific nodes https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ | `{}` | diff --git a/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml b/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml index 80776c2552..075bc16df4 100644 --- a/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml +++ b/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml @@ -44,9 +44,10 @@ spec: securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true +{{- if .Values.prometheusOperator.securityContext }} securityContext: - runAsNonRoot: true - runAsUser: 65534 +{{ toYaml .Values.prometheusOperator.securityContext | indent 8 }} +{{- end }} serviceAccountName: {{ template "prometheus-operator.operator.serviceAccountName" . }} {{- with .Values.prometheusOperator.nodeSelector }} nodeSelector: diff --git a/stable/prometheus-operator/values.yaml b/stable/prometheus-operator/values.yaml index 93923615a6..918fa43533 100644 --- a/stable/prometheus-operator/values.yaml +++ b/stable/prometheus-operator/values.yaml @@ -530,6 +530,10 @@ prometheusOperator: # - e2e-az1 # - e2e-az2 + securityContext: + runAsNonRoot: true + runAsUser: 65534 + ## Prometheus-operator image ## image: